Critical TrueConf Vulnerability Under Active Exploitation Added to CISA’s KEV Catalog The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-3502, a severe vulnerability in TrueConf Client software, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw, classified as a "Download of Code Without Integrity Check" (CWE-494), allows attackers to bypass security checks during software updates. When TrueConf’s updater retrieves files, it fails to verify their authenticity, enabling threat actors to intercept and replace legitimate updates with malicious payloads. Successful exploitation grants arbitrary code execution, potentially leading to full system compromise, backdoor installation, or lateral movement within corporate networks. CISA issued the alert on April 2, 2026, setting a remediation deadline of April 16, 2026, for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 22-01. While the mandate applies only to federal entities, security experts warn that private organizations, educational institutions, and individuals using TrueConf are also at risk. TrueConf users are advised to apply vendor-provided patches immediately and follow CISA’s mitigation guidance, including securing cloud service routes. If no patch is available, discontinuing use of the software is recommended. Though it remains unclear whether ransomware groups are exploiting this flaw, its potential for malware deployment and data theft makes it a prime target for cybercriminals.